{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mirth-connect-v4.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mirth Connect (\u003c=v4.7.1)"],"_cs_severities":["high"],"_cs_tags":["medical-devices","vulnerability","cisa","ics"],"_cs_type":"advisory","_cs_vendors":["NextGen Healthcare"],"content_html":"\u003cp\u003eNextGen Healthcare Mirth Connect versions 4.7.1 and earlier are affected by multiple high-severity vulnerabilities. These flaws include CVE-2026-82583, a SQL injection vulnerability within the Database Connector API that allows authenticated users to execute arbitrary SQL commands, potentially leading to credential disclosure, arbitrary file writes, and denial-of-service. Additionally, CVE-2026-78224 and CVE-2026-82578 involve improper restriction of XML External Entity (XXE) references within the XSLT Transformer step and XML batch processing, respectively. These XXE vulnerabilities enable unauthenticated attackers to perform data exfiltration and cause denial-of-service conditions. Mirth Connect is widely used in the healthcare sector for clinical data integration, making these flaws a significant target for actors seeking unauthorized access to sensitive medical data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities can result in severe consequences, including the compromise of stored credentials for integrated systems, unauthorized access to sensitive patient data, arbitrary file system manipulation, and persistent denial-of-service of the Mirth Connect interface. These vulnerabilities affect healthcare organizations worldwide, potentially disrupting critical clinical workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade NextGen Healthcare Mirth Connect to version 4.7.2 or later as recommended by the vendor.\u003c/li\u003e\n\u003cli\u003eMinimize network exposure by ensuring Mirth Connect instances are not directly accessible from the internet and are located behind firewalls.\u003c/li\u003e\n\u003cli\u003eImplement defense-in-depth strategies to isolate clinical systems from general business networks.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs and database access logs for anomalous SQL queries or attempts to inject external entities into XML processing streams.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T16:07:02Z","date_published":"2026-09-10T16:07:02Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mirth-connect-vulns/","summary":"NextGen Healthcare Mirth Connect versions 4.7.1 and earlier contain three critical vulnerabilities including SQL injection and XML External Entity (XXE) injection flaws that allow for unauthorized data access and denial-of-service.","title":"Critical Vulnerabilities in NextGen Healthcare Mirth Connect","url":"https://feed.craftedsignal.io/briefs/2026-09-mirth-connect-vulns/"}],"language":"en","title":"CraftedSignal Threat Feed - Mirth Connect (\u003c=V4.7.1)","version":"https://jsonfeed.org/version/1.1"}